Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 14:53
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVICE.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PAYMENT ADVICE.exe
Resource
win10v2004-20220812-en
General
-
Target
PAYMENT ADVICE.exe
-
Size
471KB
-
MD5
20c4471b875e64c7943c225a359eb227
-
SHA1
3551c6ddbe76927927a22262af48c225a9c28d6b
-
SHA256
4af278d681249a1d292e0b0eb662f20ec919f984bf1c3d3ed0cff961fe0ef887
-
SHA512
72b2fb581a3e9efa8b9bde02507dce59a3e094fbc9d3c98701ce4ff5a37d152708a50c0b546232c073115e5e9988d9f3d7d33c1418d9fefa7c1236100d06deef
-
SSDEEP
12288:DcKn2SMgBEWoCruaOwVrf3iNWiPpq72IanrSy00kZlXa:DL6LmuZGf3ijBkMrSRzZRa
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5247127509:AAGW6jgaK8wg9Olc3UxNFqjLkvAv8DEdQEY/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PAYMENT ADVICE.exedescription pid process target process PID 4868 set thread context of 1468 4868 PAYMENT ADVICE.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CasPol.exepid process 1468 CasPol.exe 1468 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CasPol.exedescription pid process Token: SeDebugPrivilege 1468 CasPol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PAYMENT ADVICE.exedescription pid process target process PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe PID 4868 wrote to memory of 1468 4868 PAYMENT ADVICE.exe CasPol.exe -
outlook_office_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
outlook_win_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-134-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-135-0x000000000043598E-mapping.dmp
-
memory/1468-137-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/1468-138-0x0000000005940000-0x00000000059DC000-memory.dmpFilesize
624KB
-
memory/1468-139-0x0000000006610000-0x0000000006676000-memory.dmpFilesize
408KB
-
memory/1468-140-0x0000000006B40000-0x0000000006B90000-memory.dmpFilesize
320KB
-
memory/1468-141-0x0000000007320000-0x00000000073B2000-memory.dmpFilesize
584KB
-
memory/1468-142-0x00000000072B0000-0x00000000072BA000-memory.dmpFilesize
40KB
-
memory/4868-132-0x0000021EAB000000-0x0000021EAB07A000-memory.dmpFilesize
488KB
-
memory/4868-133-0x00007FFA6DF40000-0x00007FFA6EA01000-memory.dmpFilesize
10.8MB
-
memory/4868-136-0x00007FFA6DF40000-0x00007FFA6EA01000-memory.dmpFilesize
10.8MB